Employees are allowed access to internal websites. An employee connects to an internal website and IDS reports it as malicious behavior. What is this example of?

A true positive means the alert correctly identified real malicious behavior, but access to the site is authorized so no actual threat occurred.

A false negative means a real attack occurred but was NOT detected; the IDS did generate an alert, so this is not a missed detection.

A false positive occurs when a security control incorrectly identifies benign, authorized activity as malicious. Because the employee has explicit permission to access the internal website, the IDS alert is inaccurate, making it a false positive rather than evidence of a real threat.

A true negative means no threat existed and no alert was raised; an alert was raised here, so this cannot be a true negative.